Warning: Not sure if this question is a good fit for this SE, but I need serious advice that I can get no where else
Over the weekend, massive number of files and folders were deleted from our DFS. I cannot find anyway to trace whether it was a program or someone who deleted them. There a a few things I observe:
- In root namespace, out of the folders that survived the mass delete, all had contents intact except for the first sub-folder ordered by name, which only has partial files intact. - this leads me to think files were deleted at the root folders in named sequence.
- In root namespace, all of the folders has partial content deleted. - this leads me to think that root folders were deleted in parallel.
Does a normal select all folders and delete generate this kind of deleting sequence? Is there anyway to trace who or what deleted it? I checked the auditing event logs but cannot find anything about deleting files and folders.